The vulnerability comes from an ActiveX control known as the Certificate Enrollment Control, which allows web-based certificate enrollments. By design, this type of control should be able to install new certificates, but should never be able to access certificates that are already on the user's system. The control contains a flaw that could enable a web page, through a complex process, to invoke the control in a way that would delete certificates on a user's system.
An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, email signing certificates, and any other certificates on the system, thereby preventing the user from using these features.
According to Microsoft, an attack could be carried out through either of two scenarios. The attacker could create a web page that exploits the vulnerability, and host it on a web site in order to attack users who visited the site or the attacker could send the page as an HTML mail in order to attack the recipient.
Security firm @stake, warns that since the Microsoft Terminal Server ActiveX client is signed by Microsoft and marked safe, there is no warning with the default Internet Explorer security settings if you have previously selected to trust all controls signed by Microsoft. In its report on the vulnerability, the company reiterates that users should not trust any ActiveX components from an unknown source, as a malicious site could use an old vulnerable version of the ActiveX control even after the patched ActiveX component is available from Microsoft. If users install the latest vendor cumulative patch for Internet Explorer this problem is eliminated.
The vulnerability affects Windows 98, 98(2E), NT4.0, Millennium, 2000 and XP. A cumulative patch will be available later today, which also addresses a similar, but less serious vulnerability discovered in the SmartCard Enrollment control in Windows 2000 XP. For those that want to download the patch immediately, click on the your system's version of Windows:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition
- Microsoft Windows Me
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0, Terminal Server Edition
- Microsoft Windows 2000
- Microsoft Windows XP
- Microsoft Windows XP 64-bit Edition
Customers who operate web sites that use the Certificate Enrollment Control will need to make minor revisions to their web applications in order to use the new control. A patch for operators sets the "Kill Bit" on the original version of the control, and provides a new control.